What scope should a validator's statistical guarantee actually state?

Once semantic validity is a statistical property rather than a deterministic one (Can validator consensus guarantee both agreement and semantic correctness?), the next question is what a number like "false endorsement is bounded by eδ" is a number about. The Honest Quorum paper (2607.16109) answers in its discussion: "The scope of these events must be stated with the certificate." It then separates four scopes that are easy to run together:

• Pointwise. A per-candidate claim. It applies to one candidate, one state, one policy and one evidence package.
• Domain-conditional. The claim holds only inside a calibrated workload domain D.
• Average-case. The claim averages over a task distribution on that domain.
• Uniform. The claim bounds every admissible task in the stated class.

And the sentence that carries the weight: "These are not interchangeable guarantees."

The ordering by strength is this note's reading, but it follows from the definitions. An average-case bound can be met by a validator that is excellent on most tasks and bad on a few, so it says little about any particular candidate. A domain-conditional bound says nothing at all about a request that falls outside D. A pointwise bound is about a single case and does not generalize. Only a uniform bound speaks to the worst admissible task, which is the one a safety boundary is about. Applied to the paper's example, a validator calibrated on routine deployment changes could carry a respectable average-case figure and a domain-conditional one, and neither would tell you much about a service-account escalation that crosses a control-plane isolation boundary, unless that kind of request is inside D.

The reason this is worth its own note is that it travels. Any headline of the form "the AI reviewer catches N percent" is a claim with a scope, and the scope is usually unstated. A benchmark score is an average-case claim over the benchmark's task distribution; a deployment decision often needs a uniform or at least domain-conditional one over the tasks that will actually arrive. The vault has the same gap from the evaluation side: Do cybersecurity benchmarks actually measure exploitation? is a case of strong scores on neighbouring task distributions being read as coverage of a different one, and Why do language models fail at temporal reasoning in complex tasks? shows competence that holds in one task format and not in another, which is what a domain-conditional claim would have to fence off.

A practical rule falls out: when a guarantee about an LLM validator is reported, ask which of the four it is, and what D and the task distribution are. If the answer is missing, treat the claim as unscoped rather than as uniform.

The number a scope qualifies has to come from measuring the validator on labelled cases, and the vault holds one statement of how to keep that step honest: Can deterministic checks protect LLM judges from failure? says to measure correctness instead of asserting it, on a partition nothing that proposes changes can see. Read against this note, the hidden partition is what would let a calibration set stand as a measurement of the domain D and not as something the proposer has tuned to; which cases the partition holds still decides what D is. This is my pairing; the guardrail excerpt concerns an LLM judge inside an optimizer loop, not validators or certificates, and gives no measurements.

What the excerpt does not give. How the paper's theorems use each scope, which scope its results actually deliver, and any worked example of a calibrated domain D. The four definitions and the requirement to state scope with the certificate are what the excerpt contains; the strength ordering and the applications above are this note's.